Amendment and Response 

Applicant: N. Lee Rhodes 
Serial No.: 09/919,527 
Filed: July 31, 2002 
Docket No.: 10013111-1 

Title: NETWORK USAGE ANALYSIS SYSTEM AND METHOD FOR UPDATING STATISTICAL 
MODELS 

REMARKS 

The following remarks are made in response to the Office Action mailed December 6, 
2004. Claims 1-45 were rejected. With this Response, claims 1, 5, 13, 23-26, 29, 36, 37 and 
45 have been amended. Claims 46 and 47 have been added. Claims 1-47 remain pending in 
the application and are presented for reconsideration and allowance. 

Claim Rejections under 35 U.S.C. § 112 

Claims 25, 26, 27 and 28 are rejected under 35 U.S.C. 1 12, second paragraph, based 
on insufficient antecedent basis. With this Response, Applicant has corrected the dependency 
of dependent claims 24, 25, and 26. Applicant believes this change results in a correction of 
the antecedent basis errors as outlined by the Examiner. Accordingly, Applicant requests that 
the above rejection of claims 25, 26, 27, and 28 under 35 U.S.C. § 112, second paragraph, be 
withdrawn. 

Claim Rejections under 35 U.S.C. § 102 and § 103 

Claims 1-2, 37-28, and 45 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Porras et al., U.S. Patent No. 6,321,338 (Porras). 

Further, claim 13 is rejected under 35 U.S.C. 103(a) as being unpatentable over Porras 
et al. and further in view of Sarkissian et al., U.S. Patent No. 6,771,646 (Sarkissian et al.). 
Claims 23 and 26 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras and 
in view of Sarkissian and further in view of Kawasaki, U.S. Patent No. 6,539,375 (Kawasaki) 
and Fishman et al., U.S. Patent Application Publication No. 2001/0037321 (Fishman). 
Claims 29, 31-35 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras and 
in view of Sarkissian and further in view of Fishman et al. and Costa, U.S. Patent No. 
6,138,121 (Costa). Claims 3 and 39 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras as applied to claims above, and further in view of Steinbiss et al., 
U.S. Patent No. 6,823,307 (Steinbiss). Claims 4 and 40 are rejected under 35 U.S.C. 103(a) 
as being unpatentable over Porras and Steinbiss as applied to claims above, and further in 
view of Sarkissian. Claims 5-6, 12, and 41-42 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras, Steinbiss, and Sarkissian as applied to claims above, and further in 
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view of Costa. Claims 7, 11, 14-22, and 24-25 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Porras, Steinbiss, Sarkissian, and Costa as applied to claims above and 
further in view of Aboulnaga et al., U.S. Patent No. 6,460,045 (Aboulnaga). Claims 8-10, 30, 
and 43-44 are rejected under 35 U.S.C. 103(a) as being unpatentable over Porras, Steinbiss, 
Sarkissian, and Costa as applied to claims above, and further in view of Fishman. 

Applicant has amended independent claims 1, 13, 23, 29, 37 and 45 to include claim 
limitations similar to those found in independent claim 23. Accordingly, only the claim 
rejections under 35 U.S.C. § 103 are discussed in detail herein. 

Applicant submits that Porras either alone or in view of Sarkissian, Kawasaki, 
Costa and Fishman fail to teach or suggest the invention of independent claim 1. 

Independent claim 1 has been amended to recite a method for analyzing a stream of 
network usage data. The method includes generating a statistical model from a set of usage 
data record events. A most recent record event is received. The statistical model is updated 
using the most recent record event by adding the most recent record event to the statistical 
model, wherein an identifier is associated with each record event, including updating only a 
portion of the statistical model associated with the identifier. 

Porras discloses a method of network surveillance including building at least one 
long-term and at least one short-term statistical profile of network packets that monitor data 
transfers, errors, or network connections. The long-term profile is compared to the short-term 
profile to determine whether suspicious network activity exists. See Porras, column 1, lines 
44-54. 

Sarkissian merely recites the cache structure for looking up one or more elements of 
an external memory. The cache structure is used for storing information associated with 
network packets. 

Costa merely discloses the use of an aggregation table in tracking network status 

events. 

Kawasaki discloses a method and system for generating and using a computer user's 
personal interest profile. 

Fishman recites a method of building predictive models on transactional data. In the 
system of Fishman, sets of aggregation models are utilized, wherein each transactional source 
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of data is processed by a dedicated aggregation module. When a new transactional record 
becomes available the output of the model is updated by processing the new records only 
associated with a dedicated aggregation module. The output of each aggregation module is 
an array of scaler numbers that can be used as an input to a traditional modeling module. See 
Fishman, paragraph [008]. 

Applicant submits that Porras, either alone or in view of Sarkissian, Kawasaki, Costa, 
and Fishman fail to disclose the invention of independent claim 1. As conceded by the 
Examiner, Porras, Sarkissian, Costa, and Kawasaki fail to disclose updating a statistical 
model using the most recent record event by adding the most recent record event to the 
statistical model, wherein an identifier is associated with each record event, including 
updating only a portion of the statistical model associated with the indentifier. Further, 
Fishman also fails to teach or suggest an identifier associated with each record event, 
including updating only a portion of the statistical model associated with the identifier. 
Fishman merely recites a method of building predictive models on transactional data where 
each transactional source is processed by a dedicated aggregation module. The output of 
aggregation modules are saved, such that when new transactional records are available the 
output of the model is updated by processing only new records. The records are then fed into 
the traditional module. In contrast, Applicants method includes generating a statistical 
model from a set of usage data record events. An identifier is associated with each 
record event. A most recent record event is received. The statistical model is updated 
by updating only a portion of the statistical model associated with the identifier. Again, 
Fishman fails to disclose updating only a portion of the statistical model associated with 
an identifier. As such, one could not combine the teachings of Porras, Sarkissian, Costa, 
Kawasaki, and Fishman, and arrive at the invention of independent claim 1. For similar 
reasons, Applicant submits that independent claims 1, 13, 23, 29, 37 and 45 are also 
allowable over the art of record. 

Dependent claims 2-12, 14-22, 24-28 and 38-44 depend directly or indirectly upon 
corresponding independent claims 1, 13, 23, 37 and 45. Accordingly, Applicant believes 
these dependent claims to also be allowable over the art of record. 

Further, Applicant submits that none of the cited references, either alone or in 
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combination teach or suggest the invention of amended independent claim 29. None of 
the cited references teach or suggest defining a statistical model for analyzing the stream 
of network usage data over the rolling time interval, including a histogram having a 
first axis illustrating total usage defined by a number of bins, each bin having a usage 
variable range, and a second axis defined by a frequency corresponding to a number of 
users having a total usage within the usage variable range of each bin. Further, none of 
the cited references, either alone or in combination, recite generating the statistical model 
over the rolling time interval using each record event stored in the history cache 
including generating an aggregation table, and updating the statistical model using a 
most recent record event for a most recent update time interval including updating only 
a portion of the aggregation table associated with the most recent update time interval. 
In view of the above, Applicant submits that the above rejection of independent claim 29 
under 35 U.S.C. § 103 should be withdrawn. 

Dependent claims 30-36 depend either directly or indirectly upon independent claim 
29. Accordingly, Applicant believes these dependent claims to also be allowable over the art 
of record. 

Added Claims 

With this Response, Applicant has added claims 46 and 47 directed to a method of 
analyzing network usage data. Applicant believes independent claims 46 and 47 to be 
allowable over the art of record. 
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CONCLUSION 

In view of the above, Applicant respectfully submits that pending claims 1-47 are in 
form for allowance and are not taught or suggested by the cited references. Therefore, 
reconsideration and withdrawal of the rejections and allowance of claims 1-47 is respectfully 
requested. 

The Examiner is invited to contact the Applicant's representative at the below-listed 
telephone numbers to facilitate prosecution of this application. 

Any.inquiry regarding this Amendment and Response should be directed to either 
William J. Streeter at Telephone No. (970) 898-3886, Facsimile No. (970) 898-7247 or 
Steven E. Dicke at Telephone No. (612) 573-2002, Facsimile No. (612) 573-2005. In 
addition, all correspondence should continue to be directed to the following address: 

Hewlett-Packard Company 

Intellectual Property Administration 
P.O. Box 272400 

Fort Collins, Colorado 80527-2400 

Respectfully submitted, 

N. Lee Rhodes, 

By their attorneys, 

DICKE, BILLIG & CZAJA, PLLC 
Fifth Street Towers, Suite 2250 
100 South Fifth Street 
Minneapolis, MN 55402 
Telephone: (612) 573-2002 
Facsimile: (612) 573-2005 

Date: 7, 2^)^ < prQ^s^ f l\e£t 

SED:jan Steven E. Dicke 

Reg. No. 38,431 



CERTIFICATE UNDER 37 C.F.R. 1.8 : The undersigned hereby certifies that this paper or papers, as described herein, 
are being deposited in the United States Postal Service, as first class mail, in an envelope address to: Commissioner for 
Patents, P.O. Box 1450, Alexandria, VA 22313-1450 on this "7 day of March, 2005. 



By. 

Name: Steven E. Dicke 
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